CWE-693: Protection Mechanism Failure, page 13
Filter
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
What the weakness is: CWE-693 at MITRE
Ask an AI about CWE-693
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-693: Protection Mechanism Failure and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/693.html and https://cve.bz/cve/cwe/693?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2025-26431EPSS 0.09%
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution p…
- 6.1CVE-2025-48554EPSS 0.08%
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User…
- 7.8CVE-2025-48546EPSS 0.09%
In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interac…
- 8.8CVE-2025-48534EPSS 0.3%
In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is…
- 7.8CVE-2025-48531EPSS 0.1%
In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
- 7.8CVE-2025-48522EPSS 0.10%
In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. U…
- 7.8CVE-2025-32331EPSS 0.1%
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inter…
- 7.8CVE-2025-26464EPSS 0.10%
In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User i…
- 7.8CVE-2025-0089EPSS 0.1%
In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
- 7.8CVE-2025-26458EPSS 0.09%
In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User i…
- 7.8CVE-2025-26444EPSS 0.09%
In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in t…
- 7.3CVE-2025-26443EPSS 0.1%
In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in the code. This could lead to local escalation of privilege with no additional exec…
- 7.8CVE-2025-36905EPSS 0.09%
In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not nee…
- 7.8CVE-2025-36898EPSS 0.09%
There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 8.8CVE-2025-9866EPSS 0.5%
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
- 7.8CVE-2025-22437EPSS 0.1%
In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges …
- 7.8CVE-2025-22434EPSS 0.09%
In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
- 7.8CVE-2025-22433EPSS 0.10%
In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due to a logic error in the code. This could lead to local escalation of privilege wi…
- 5.5CVE-2025-22431EPSS 0.08%
In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots wi…
- 9.8CVE-2025-22429EPSS 0.3%
In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for …
- 7.3CVE-2025-22427EPSS 0.09%
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in the code. This could lead to local escalation of privilege with no additional ex…
- 7.8CVE-2024-49720EPSS 0.10%
In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri…
- 5.4CVE-2025-20347EPSS 0.3%
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on…
- 9.8CVE-2025-43728EPSS 0.4%
Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- 9.8CVE-2025-54143EPSS 0.5%
Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.
- 4.3CVE-2025-50897EPSS 0.3%
A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with write permissions (PTE_W) in SV39 mode may incorrectly trigger a Store/AMO access …
- 4.1CVE-2025-24835EPSS 0.1%
Protection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allow an authenticated user to potentially enable denial of service via local access.
- 5.1CVE-2025-24523EPSS 0.2%
Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
- 7.0CVE-2025-3770EPSS 0.2%
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, an…
- 6.8CVE-2025-8656EPSS 0.3%
Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on affected installations of Kenwood DMX958XR devices. Authentication is not requi…
- 9.1CVE-2025-43273EPSS 0.7%
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.8. A sandboxed process may be able to circumvent sandbox restrictions.
- 9.8CVE-2025-43261EPSS 0.8%
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
- 8.1CVE-2025-8032EPSS 0.4%
XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
- 6.9CVE-2025-52951EPSS 0.4%
A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface. …
- 8.5CVE-2025-46358EPSS 0.2%
Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- 8.8CVE-2025-49740EPSS 0.9%
Protection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
- 6.8CVE-2025-48800EPSS 0.7%
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- 6.8CVE-2025-48003EPSS 0.6%
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- 7.5CVE-2025-47984EPSS 23%
Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network.
- 7.8CVE-2025-47159EPSS 0.4%
Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- 7.7CVE-2025-41224EPSS 0.3%
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.10.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.10.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.10.0…
- 9.1CVE-2025-6427EPSS 0.4%
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140…
- 6.1CVE-2025-49193EPSS 0.3%
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not execu…
- 5.4CVE-2025-47160EPSS 0.8%
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- 7.5CVE-2025-33050EPSS 1.8%
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- 7.5CVE-2025-32725EPSS 1.8%
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- 8.2CVE-2025-31189EPSS 0.2%
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox.
- 8.4CVE-2025-27700EPSS 0.1%
There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.1CVE-2025-41232EPSS 0.6%
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethod…
- 2.0CVE-2025-21081EPSS 0.1%
Protection mechanism failure for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of privilege via local access.